SQL Injection Vulnerability in Code Clone Plugin for WordPress

CVE-2025-2478

What is CVE-2025-2478?

The Code Clone plugin for WordPress is prone to a time-based SQL Injection vulnerability via the 'snippetId' parameter. This vulnerability affects all versions up to and including 0.9, stemming from inadequate input escaping for user-supplied parameters and insufficient query preparation. Authenticated users with Administrator-level access or higher can exploit this flaw to inject additional SQL queries into existing ones, potentially allowing exposure of sensitive information from the database.

References